
United States Patent and Trademark Office 



UNITED STATES DEPARTMENT OF COMMERCE 
United States Patent and Trademark Office 

Address: COMMISSIONER FOR PATENTS 
P.O. Box 1450 

Alexandria, Virginia 223 13-1450 
www.uspto.gov 



APPLICATION NO. 


FILING DATE 


FIRST NAMED INVENTOR 


ATTORNEY DOCKET NO. 


CONFIRMATION NO. | 


10/649,169 


08/27/2003 


Leedor Agam 


2808/53 


4740 



7590 

Dr. Mark Friedman Ltd. 

c/o Polkinghorn 

9003 Florin Way 

Upper Markboro, MD 20772 



08/24/2007 



EXAMINER 



SHAN, APRIL YING 



ART UNIT 



PAPER NUMBER 



2135 



MAIL DATE 



DELIVERY MODE 



08/24/2007 PAPER 

Please find below and/or attached an Office communication concerning this application or proceeding. 



The time period for reply, if any, is set in the attached communication. 



PTOL-90A (Rev. 04/07) 



Office Action Summary 


Application No. 

10/649,169 


Applicant(s) 

AGAM ET AL 


Examiner 

April Y. Shan 


Art Unit 

2135 





The MAILING DATE of this communication appears on the cover sheet with the correspondence address 



Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after t he mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1)13 Responsive to communication(s) filed on 06 June 2007 . 
2a)[x] This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-22 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) [3 Claim(s) P22 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) Q The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)Q None of: 

1 .□ Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attachment(s) 

Notice of References Cited (PTO-892) 
Notice of Draftsperson's Patent Drawing Review (PTO-948) 



1) 

2) 

3) |_| Information Disclosure Statement(s) (PTO/SB/08) 
Paper No(s)/Mail Date 



4) □ Interview Summary (PTO-413) 
Paper No(s)/Mail Date. . 



5) 
6) 



Notice of Informal Patent Application 
Other: . 



U.S. Patent and Trademark Offbe 
PTOL-326 (Rev. 08-06) 



Office Action Summary 



Part of Paper No. /Mail Date 20070816 



Application/Control Number: 10/649,169 Page 2 

Art Unit: 2135 

DETAILED ACTION 
Response to Amendment 

1 . The Applicant's amendment, filed 06 June 2007, has been received, entered into 
the record, and respectfully and fully considered. 

2. As a result of the amendment, claims 1-22 have been amended. Claims 1-22 
are now presented for examination. 

3. Any objections/rejections not repeated below for record are withdrawn due to 
Applicant's amendment. 

Claim Rejections - 35 USC §112 

4. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

5. Claims 4-7, 9, 12-15, 17-18, 20 are rejected under 35 U.S.C. 112, second 
paragraph, as being indefinite for failing to particularly point out and distinctly claim the 
subject matter which applicant regards as the invention. 

As per claim 4, "the group" is recited. Since no group is ever recited in 
the claim, "the group" lacks of antecedent basis. 

As per claim 5, "the group" is recited. Since no group is ever recited in 
the claim, "the group" lacks of antecedent basis. 

As per claim 9, "the group" is recited. Since no group is ever recited in 
the claim, "the group" lacks of antecedent basis. 

As per claims 12 and 13, "the group" is recited. Since no group is ever 
recited in the claim, "the group" lacks of antecedent basis. 
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As per claim 17, "the group" is recited. Since no group is ever recited in 
the claim, "the group" lacks of antecedent basis. 

As per claim 20, "a one-time value" is being recited on page 7. However, 
in claim. 19, there are first one-time one-time value and second one-time value . 
are being recited. Which is this "a one-time value" referring to? Additionally, "the 
group" is recited. Since no group is ever recited in the claim, "the group" lacks of 
antecedent basis. 

Any claim not specifically addressed, above, is being rejected as 
incorporating the deficiencies of a claim upon which it depends. 



Claim Rejections - 35 USC § 103 

6. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 
USPQ 459 (1966), that are applied for establishing a background for determining 
obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 
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8. Claims 1-22 are rejected under 35 U.S.C. 103(a) as being unpatentable over Lin 
et al. (U.S. Pub. No. 20050015588). 

As per claim 1, Lin et al. discloses a security token, comprising: 
a one-time password mechanism, for rendering one-time password functionality (e.g. 
paragraph [0034]); 

a public-key mechanism, for rendering public-key functionality with respect to said one- 
time password functionality (e.g. paragraphs [0009], [0013] and [0033]- [0034]. Please 
also see below examiner's response to argument); 

and communication means for connecting said security token to said host and ("the 
token includes an interface for coupling to a computer" - e.g. abstract., paragraph 
[0028]. Please note an interface corresponds to Applicant's communication means and 
a computer corresponds to Applicant's host). 

Lin et al. does not expressly disclose the communication means for providing to 
said security token the power supply required for operating at least said public-key 

■ 

mechanism. However, Lin et al. discloses in paragraph [0028], "preferably, the interface 
26 is provided in a known Universal Serial Bus (USB) configuration for coupling to a 
known USB port 28 of the computer 30 via a USB data cable 32". To a person with 
ordinary skill in the art, USB configuration provides power to the security token. 

It would have been obvious that the interface of Lin et al. provides the security 
token the power supply required for operating at least said public-key mechanism. 

The motivation of doing so would have been USB is a serial bus standard to 
interface device and it is well known that USB provides power to the security token. 
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As per claim 2, Lin et al. discloses a token as applied above in claim 1 . Lin et al. 
further discloses comprising a display, for displaying at least said one-time password 
(e.g. paragraph [0024]). 

As per claim 3, Lin et al. discloses a token as applied above in claim 1 . Lin et al. 
further discloses comprising a smartcard chip, for secure storage of keys and for 
rendering security-related functionality (e.g. paragraph [0024]). 

As per claim 4, Lin et al. discloses a token as applied above in claim 1 . Lin et al. 
further discloses wherein said one-time password mechanism comprise means for 
generating a one-time value, said means selected from a group comprising: a real-time 
clock, and a counter (e.g. paragraph [0033]). 

As per claim 5, Lin et al. discloses a token as applied above in claim 1 . Lin et al. 
further discloses wherein said communication means is selected from a group 
comprising: a display for displaying the password and thereafter manually providing the 
displayed value to a host, means for connecting said security token to said host via a 
wired connection, and means for connecting said security token to said host via a 
wireless connection (e.g. paragraph [0028]). 
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As per claim 6, Lin et al. discloses a token as applied above in claim 5. Lin et al. 
further discloses wherein said wired communication means further comprise means for 
providing a power supply to said security token (Please see rationale in rejecting claim 1 
above). 

As per claim 7, Lin et al. discloses a token as applied above in claim 5. Lin et al. 
does not expressly discloses comprising a chargeable power source, to be charged by 
the power supplied via said communication means, for providing the power for operating 
said security token while not connected to said host. However, examiner takes official 
notice that it is common knowledge and well known in the art. It would have been 
obvious to a person with ordinary skill in the art to incorporate a chargeable power 
source, to be charged by the power supplied via said communication means, for 
providing the power for operating said security token while not connected to said host 
into Lin et al.'s token. The motivation of doing so would have been to assure that the 
token is well charged. 

As per claim 8, Lin et al. discloses a one-time password security token, for 
securely providing a one-time value to a host system, said one-time password security 
token comprising: means for generating said one-time value (please see rationale in 
rejecting claim 1 above); a public-key infrastructure mechanism, for performing public- 
key functionality with respect to said one-time value (please see rationale in rejecting 
claim 1 above); and communication means for connecting said security token with said 
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host and for providing said encrypted one-time value to said host (e.g. paragraph 
[0028]). 

As per claim 9, Lin et al. discloses a token as applied above in claim 8. Lin et al. 
further discloses wherein said public-key functionality with respect to said one-time 
value is selected from a group comprising: encrypting said one-time value by said 
public-key functionality, and digitally signing said one-time password (e.g. paragraphs 

[0033]-[0034]). 

As per claim 10, Lin et al. discloses a token as applied above in claim 8. Lin et 
al. further discloses comprising a display, for displaying at least the encrypted one-time 
value (e.g. paragraphs [0015], [0024] and [0033]-[0034]). 

As per claims 11 and 14, Lin et al. discloses a token as applied above in claim 
8. Lin et al. further discloses comprising a smartcard chip, for rendering security-related 
functionality (please see rationale in rejecting claim 3 above) and wherein said wired 
communication means further comprise means for providing a power supply to said 
security token (e.g. paragraph [0028]). 

As per claim 12, Lin et al. discloses a token as applied above in claim 8. Lin et 
al. further discloses wherein said one-time value is selected from a group comprising: 



\ 



Application/Control Number: 10/649,169 Page 8 

Art Unit: 2135 

the real-time, the value of a counter, and a group of random numbers (e.g. paragraphs 
[0015] and [0033]). 

As per claim 13, Lin et al. discloses a token as applied above in claim 13. Lin et 
al. further discloses wherein said communication means is selected from a group 
comprising: a display for displaying the password and thereafter manually providing the 
displayed value to said host, wired communication means with said host, wireless 
communication means with said host (e.g. paragraphs [0024] and [0028]). 

As per claim 15, Lin et al. discloses a token as applied above in claim 8. Lin et 
al. further discloses a chargeable power source, to be charged by the power supplied by 
said communication means, for providing the power for operating said security 
token while not connected to said host (please see above rationale in rejecting claim 7 
above). 

As per claim 16, Lin et al. discloses a security system comprising: at least one 
security token comprising: a one-time password mechanism, for rendering one-time 
password functionality (please see rationale in rejecting claim 1 above); a public-key 
mechanism, for rendering public-key functionality with respect to said one-time 
password functionality (please see rationale in rejecting claim 1 above); and 
communication means for connecting said security token to said host and for providing 
to said security token the power supply required for operating at least said public-key 
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mechanism (please see above rationale in rejecting claim 1 above); a host system, 
comprising communication means, corresponding to the 
communication means of said at least one security token, for communicating with 
said at least one security token (e.g. paragraph [0028]) and for providing to said token 
the power supply required for operating at least the public-key mechanism of said 
security token (Please see rationale in rejecting claim 1 above). 

Lin et al. further discloses in the abstract that "A token device that generates and 
displays one-time passwords and couples to a computer for inputting or receiving data 

« 

for generating and outputting one-time passwords and performing other functions is 
provided" and Lin et al. Therefore, it would have been obvious to a person with ordinary 
skill in the art at the time of the invention that a host system can have a one-time 
password mechanism, corresponding to the one-time password mechanism of said at 
least one security token, for rendering one-time password functionality; a public-key 
mechanism, corresponding to the public-key mechanism of said at least one security 
token, for rendering public-key functionality. 

The motivation of doing so would have been in order for a host system to 
"inputting or receiving data for generating and outputting one-time passwords and 
performing other functions is provided", as taught by the abstract of Lin et al. 

As per claim 17, Lin et al. discloses a system as applied above in claim 16. Lin 
et al. further discloses wherein said communication means is 
selected from a group comprising: a display embedded within each of said at 
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least one security token, for displaying the password and thereafter manually 
providing the displayed value to said host, wired communication means through 
which said at least one security token can be provided with the power supply 
required for performing public-key operations (e.g. paragraph [0028]). 

As per claim 18, Lin et al. discloses a system as applied above in claim 16. Lin 
et al. further discloses wherein each of said at least one security token further 
comprising chargeable power source, to be charged via the power supply provided by 
said communication means, for providing the power for operating said at least one 
processor while not connected to said host, thereby enabling to operate said security 
token without external power supply (Please see above rationale in rejecting claim 7 

« 

above). 

As per claim 19, Lin et al. discloses a method for authenticating a client by a 
host system, said method comprising: at said client side: (a) generating a first one-time 
value (see rationale in rejecting claim 1 above); (b) performing public-key functionality 
with respect to said one-time value (see rationale in rejecting claim 1 above); (c) 
providing said value to said host system (e.g. paragraph [0028]); at said host system 
side: (d) performing public-key functionality which corresponds to the public key 
functionality performed at step (b) with the provided value (Please see rationale in 
rejecting claim 16 above); (e) generating a second one-time value in substantially the 
same manner as said first one-time value is generated (Please see rationale in rejecting 
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claim 16 above); authenticating said client by the correspondence of said second value 
to said first value (e.g. paragraph [0034]). 

As per claim 20, Lin et al. discloses a method as applied above in claim 19. Lin 
et al. further discloses wherein said public-key functionality with respect to said one-time 
value is selected from a group comprising: encrypting said one-time value, and digitally 
signing said one-time value (e.g. paragraphs [0015], [0033]-[0034]) 

As per claim 21, Lin et al. discloses a method as applied above in claim 19. Lin 
et al. further discloses wherein said client is a security token (e.g. abstract). 

As per claim 22, Lin et al. discloses a method as applied above in claim 19. Lin 
et al. further discloses wherein providing the encrypted value to said host is carried out 
by a member of a group comprising: displaying said encrypted value at the client side 
and thereafter manually providing the displayed value to said host, means for 
connecting said security token to said host via a wired connection, and means for 
connecting said security token to said host via a wireless connection (e.g. paragraph 
[0028]). 

Response to Arguments 

9. Applicant's arguments filed 6 June 2007 have been respectfully and fully 
considered but they are not persuasive. 
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10. The Applicant's essential argument on pages 16-19, is "The provisional 
application filling - U.S. PPA 60/488,585 fails to disclose a public key mechanism as 
recited in the present application's independent claims of the present 
application. ...Provisional Application filing U.S. PPA 60/488,585 fails to disclose a 
public key mechanism of any kind", the examiner respectfully disagrees. 

First, the examiner respectfully points out in U.S. PPA 60/488,585, lines 6-9 
discloses The present invention is a unique token device that generates and 
displays one-time passwords and that also couples to a computer for inputting or 
receiving data for generating and outputting one-time passwords and other functions". 
A token device that generates and displays one-time password relates to data 
authentication. It is well known in the art that PKI/public key mechanism is one of the 
other functions besides one-time password in data authentication. 

Second, in par. [0013] of the U.S. Pub. No. 20050015588, it discloses "...The 
token may be multi-functional and capable of generating and displaying one-time 
password as well as performing other functions, such as challenge and response, 
PKI, digital certificate, and/or biometric. 

Therefore, the subject matter PKI/public key used in the rejection is 
disclosed in U.S. PPA 60/488,585, in compliance with 35 U.S.C. 112, first 
paragraph and the subject matter to be entitled to the earlier filing date of July 17, 2003. 

1 1 . The Applicant further argues this application is allowable because Lin does not 
qualify as prior art against the present application because of the PKI/public key 
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mechanism using with one-time password token was not disclosed in U.S. PPA 
60/488,585 of Lin, the examiner respectfully disagree. 

First, the examiner explained why U.S. PPA 60/488,585 of Lin, in compliance 
with 35 U.S.C. 112, first paragraph and the subject matter to be entitled to the earlier 
filing date of July 17, 2003 in the above response to arguments. 

Second, for the sake of the argument, please note PKI/public key mechanism is 
well known and common knowledge in the art. So is one-time password token using 
with PKI mechanism. 

Third, there are many more portions of the reference cited in the rejection of 
record, and that in view of the totality of these disclosures to support the examiner's 
position that PKI/public key mechanism is well known and common knowledge in the 
art. So is one-time password token using with PKI mechanism. 

Fourth, the examiner again respectfully requests the Applicant to review below 
pertinent art cited in the first action in order to response to the current office action. 

Conclusion 

12. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. In particular, RSA newsletter published on November 1, 1999, 

* 

Vol. 1 3 and issue 20. In the newsletter, RSA SedurelD 3100 smart card is discussed. 
The RSA Secure ID 3100 can store two sets of 512- or 1 ,024 - bit RSA public and 
private cryptography keys, an RSA SecurelD seed record, two digital certificates. Also, 
in the newsletter, Aladdin will integrate its eToken authentication solution with 
CyberTrust's PKI digital certificates. Therefore, Aladdin is able to offer a more 
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customizable solution to the customers in the form of eToken. Applicant is strongly 
urged to review this reference in response to the current office action. 
13. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 
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Contact Information 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to April Y. Shan whose telephone number is (571) 270- 
1014. The examiner can normally be reached on Monday - Friday, 8:00 a.m. - 5:00 
p.m., EST. 

4 , 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Y. Vu can be reached on (571) 272-3859. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1^00. 
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